CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CLSA-2026-1787038724 TuxCare security update for pyjwt (2 CVEs)

TuxCare rebuilt pyjwt to address 2 CVEs. Fixed in 1.7.1.post3+tuxcare...

CLSA-2026-1786521955 TuxCare security update for pyjwt (2 CVEs)

TuxCare rebuilt pyjwt to address 2 CVEs. Fixed in 2.3.0.post2+tuxcare...

python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens

A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...

ROOT-APP-PYPI-CVE-2026-48524 CVE-2026-48524 in PyJWT - Patched by Root

Root has patched CVE-2026-48524 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48526 CVE-2026-48526 in pyjwt - Patched by Root

Root has patched CVE-2026-48526 in the pyjwt package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-32597 CVE-2026-32597 in PyJWT - Patched by Root

Root has patched CVE-2026-32597 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48522 CVE-2026-48522 in PyJWT - Patched by Root

Root has patched CVE-2026-48522 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48523 CVE-2026-48523 in PyJWT - Patched by Root

Root has patched CVE-2026-48523 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48525 CVE-2026-48525 in PyJWT - Patched by Root

Root has patched CVE-2026-48525 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

CLSA-2025-1756858338 TuxCare security update for pyjwt (1 CVE)

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 2.3.0.post1+tuxcare...

Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector uses yaml-1.10.2.tgz, idna-3.10-py3-none-any.whl, pyjwt-2.12.1-py3-none-any.whl, postcss-8.5.3.tgz, postcss-selector-parser-6.0.10.tgz which are vulnerable to CVE-2026-33532, CVE-2026-45409, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525,...

Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector uses pillow-12.2.0-cp314-cp314-manylinux227x8664.manylinux228x8664.whl, immutable-4.3.8.tgz, urllib3-2.6.3-py3-none-any.whl, form-data-4.0.5.tgz, pyjwt-2.12.1-py3-none-any.whl which are vulnerable to CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380,...

Oracle Linux 10 : fence-agents (ELSA-2026-19138)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19138 advisory. - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 - bundled pyasn1: replace with dependency to fix CVE-2026-30922 Tenab...

Oracle Linux 10 : fence-agents (ELSA-2026-25902)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-25902 advisory. - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 - bundled pyasn1: replace with dependency to fix CVE-2026-30922 Tenable has...

fence-agents security update

4.16.0-21.2 - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 4.16.0-21.1 - bundled pyasn1: replace with dependency to fix CVE-2026-30922 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-157187, RHEL-155668...

python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens

A flaw was found in PyJWT. A remote attacker can exploit this by supplying an arbitrarily large Base64URL payload segment when verifying detached JSON Web Signature JWS tokens using the unencoded-payload option. This forces excessive CPU work and memory allocations, leading to a Denial of Service...

EulerOS 2.0 SP12 : python-jwt (EulerOS-SA-2026-2557)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

PYSEC-2026-1814 PyJWT Issuer field partial matches allowed

Summary The wrong string if check is run for iss checking, resulting in "acb" being accepted for "abc". Details This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. diff - if isinstanceissuer, list: + if...

Important: Red Hat Security Advisory: fence-agents security update

An update for fence-agents is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...